@danderson @raito @astrid the way we see it, the primary exploit here was the social one (see details at [1]). this is absolutely what passes for stealth on that front.

[1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor